CVE-2023-35784: Double Free
First published: Fri Jun 16 2023(Updated: )
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openbsd Libressl | <3.6.3 | |
| Openbsd Libressl | >=3.7.0<3.7.3 | |
| Openbsd Openbsd | =7.2 | |
| Openbsd Openbsd | =7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.3-relnotes.txt
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/026_ssl.patch.sig
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/004_ssl.patch.sig
- https://github.com/libressl/openbsd/commit/1d6680b3682f8caba78c627dee60c76da6e20dd7
- https://github.com/libressl/openbsd/commit/96094ca8757b95298f49d65c813f303bd514b27b
- https://github.com/libressl/openbsd/commit/e42d8f4b21a8a498e2eabbffe4c7b7d4ef7cec54
Frequently Asked Questions
What is CVE-2023-35784?
CVE-2023-35784 is a vulnerability that allows for a double free or use after free after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3.
Which software versions are affected by CVE-2023-35784?
Openbsd Libressl versions up to 3.6.3 and Openbsd Libressl versions 3.7.0 to 3.7.3, as well as Openbsd Openbsd versions 7.2 and 7.3 are affected by CVE-2023-35784.
What is the severity of CVE-2023-35784?
CVE-2023-35784 has a severity rating of critical (9.8).
How do I fix CVE-2023-35784?
To fix CVE-2023-35784, users should update to OpenBSD 7.2 errata 026 or later, OpenBSD 7.3 errata 004 or later, LibreSSL 3.6.3 or later, or LibreSSL 3.7.3 or later.
Where can I find more information about CVE-2023-35784?
More information about CVE-2023-35784 can be found in the OpenBSD LibreSSL release notes for versions 3.6.3 and 3.7.3, as well as the OpenBSD patches for 7.2 errata 026.
- collector/nvd-index
- collector/nvd-api
- agent/tags
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/openbsd
- canonical/openbsd libressl
- version/openbsd libressl/3.7.0
- canonical/openbsd openbsd
- version/openbsd openbsd/7.2
- version/openbsd openbsd/7.3